global-stock-data

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes a hard-coded API token ("D43BF722C8E33BDC906FB84D85E326E8") in its code, which is a credential-like secret present verbatim in the prompt and therefore could be exfiltrated if the LLM outputs it.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the Skill/README/Changelog files for literal credentials. I ignored obvious placeholders and low-entropy values (e.g., "your-name your-email@example.com", "contact@example.com", author email addresses, repo URLs, and simple example/passwords). I found one high-entropy-looking literal value that appears to be an access token (not a documented placeholder): the Eastmoney search API token string is a 32-hex-character token embedded in the code and passed to the Eastmoney suggest API — this looks like a real client token/credential and not a generic placeholder. No private keys, API provider secrets (e.g., sk-... style), or redaction markers were present elsewhere.